Address comments

docs/simplesamlphp-changelog.md

@@ -16,7 +16,7 @@ See the upgrade notes for specific information about upgrading.
     to comply with SAML2INT
   * core:PairwiseID and core:SubjectID authprocs no longer support the 'scope' config-setting.
     Use 'scopeAttribute' instead to identify the attribute holding the scope.
-  * Unsolicited responses can denied by disabling it by setting `disable_unsolicited` to `true` in the SP authsource.
+  * Unsolicited responses can denied by disabling it by setting `enable_unsolicited` to `true` in the SP authsource.
 
 ## Version 1.19.1
 

modules/saml/docs/sp.md

@@ -219,8 +219,8 @@ Options
     in the IdP-remote metadata overrides this the option in the SP
     configuration.
 
-`disable_unsolicited`
-:    Whether this SP will refuse to process unsolicited responses. The default value is `false`.
+`enable_unsolicited`
+:    Whether this SP is willing to process unsolicited responses. The default value is `true`.
 
 `discoURL`
 :   Set which IdP discovery service this SP should use.

modules/saml/lib/Auth/Source/SP.php

@@ -1139,10 +1139,6 @@ class SP extends \SimpleSAML\Auth\Source
 
         if (isset($state['saml:sp:isUnsolicited']) && (bool) $state['saml:sp:isUnsolicited']) {
             $spMetadata = $source->getMetadata();
-            $disableUnsolicited = $spMetadata->getBoolean('disable_unsolicited', false);
-            if ($disableUnsolicited === true) {
-                throw new Error\BadRequest('Unsolicited responses are denied by configuration.');
-            }
 
             if (!empty($state['saml:sp:RelayState'])) {
                 $redirectTo = $state['saml:sp:RelayState'];

modules/saml/www/sp/saml2-acs.php

@@ -101,8 +101,8 @@ if (!empty($stateId)) {
     }
 }
 
-$disableUnsolicited = $spMetadata->getBoolean('disable_unsolicited', false);
-if ($state === null && $disableUnsolicited === true) {
+$enableUnsolicited = $spMetadata->getBoolean('enable_unsolicited', true);
+if ($state === null && $enableUnsolicited === false) {
     throw new Error\BadRequest('Unsolicited responses are denied by configuration.');
 }
 
@@ -158,13 +158,13 @@ $expire = null;
 $attributes = [];
 $foundAuthnStatement = false;
 
-// check for duplicate assertion (replay attack)
 $config = Configuration::getInstance();
 $storeType = $config->getString('store.type', 'phpsession');
 
 $store = StoreFactory::getInstance($storeType);
 
 foreach ($assertions as $assertion) {
+    // check for duplicate assertion (replay attack)
     if ($store !== false) {
         $aID = $assertion->getId();
         if ($store->get('saml.AssertionReceived', $aID) !== null) {